Commit message (Collapse) | Author | Age | |
---|---|---|---|
* | redirect knotes to kmail, some tweaks | smitsohu | 2018-03-30 |
| | |||
* | various blacklist additions | smitsohu | 2018-03-28 |
| | |||
* | rework akonadi integration | smitsohu | 2018-03-26 |
| | | | | | | | | | | | | | | | | | | | | | | | | | | the usr.sbin.mysqld-akonadi apparmor profile, enforced by default in ubuntu and debian testing (and probably opensuse), doesn't play well with a number of firejail options. the reason for this is that once the no_new_privs bit is set, apparmor profile transitions are forbidden. enforcing our own apparmor policy instead is also no solution, because these programs don't even start without d-bus. relaxing the kmail profile was necessary so that kmail can fire up akonadi itself, just in case akonadi has not been started earlier already by another program. this is always an issue when kmail is the only installed akonadi client, but there may be more circumstances. for reasons outlined above this doesn't help debian and ubuntu (opensuse?) users though :-/ a brief summary of the seccomp exceptions: chroot is needed for qt webengine, io_prioset for the akonadi indexing agent, io_getevents, io_submit, io_setup are needed for mysqld. when akonadi has an sqlite3 backend, less exceptions to the seccomp filter are necessary, but mysqld is the default. in the future all kontact suite profiles (itm only kmail, knotes) should probably be redirections to akonadi_control, but the issues with apparmor make this somewhat impractical for now (options like 'protocol' couldn't go to akonadi_control.local any more, if current kmail redirected to there). | ||
* | various profile hardening | smitsohu | 2018-03-25 |
| | |||
* | fix akonadi_control, enable it in firecfg for a better default | smitsohu | 2018-03-24 |
| | |||
* | add basic akonadi integration | smitsohu | 2018-03-24 |
| | | | | | as it is now, there is no support for a full akonadi session inside the knotes sandbox, but knotes can connect to akonadi and should work fine | ||
* | enable email encryption for thunderbird, kmail | smitsohu | 2018-02-03 |
| | | | | see #1653 #1572 | ||
* | fix (and harden) kmail - #1541 | smitsohu | 2017-12-10 |
| | |||
* | Fix nodvd placement | Tad | 2017-08-13 |
| | |||
* | added nodvd to most profiles | netblue30 | 2017-08-13 |
| | |||
* | Fix notv placement | Tad | 2017-08-11 |
| | |||
* | added notv to most profiles | netblue30 | 2017-08-11 |
| | |||
* | Unify all profiles | Tad | 2017-08-07 |
| | |||
* | added /etc/firejail/globals.local for global customizations | netblue30 | 2017-05-23 |
| | |||
* | persistent support for all profile files | netblue30 | 2017-02-09 |
| | |||
* | various fixes | valoq | 2016-11-18 |
| | |||
* | squash attempt 2 | Fred-Barclay | 2016-10-24 |
| | |||
* | tightened profiles | Fred-Barclay | 2016-08-17 |
| | |||
* | merged Various #542 pull request from Fred-Barclay | netblue30 | 2016-05-31 |
| | |||
* | profiles: Add nonewprivs where sensible | The Fox in the Shell | 2016-05-25 |
| | |||
* | delete blacklist wine from profiles | avoidr | 2016-04-12 |
| | |||
* | introducing disable-passwdmgr.inc | netblue30 | 2016-03-28 |
| | |||
* | consolidated disable-terminals into disable-common | netblue30 | 2016-03-27 |
| | |||
* | consolidating disable-mgmt and disable-sercret into disable-common | netblue30 | 2016-03-26 |
| | |||
* | profile work | netblue30 | 2016-03-26 |
| | |||
* | split out terminal blacklisting in disable-terminals.inc | netblue30 | 2016-02-12 |
| | |||
* | added kmail profile | netblue30 | 2016-01-12 |